Security Bulletin: Vulnerabilities in Jinja, idna & cryptography can affect IBM Storage Protect Plus Microsoft File Systems Backup and Restore

Summary IBM Storage Protect Plus Microsoft File Systems Backup and Restore can be affected by vulnerabilities in Jinja, idna & cryptography which include cross-site scripting & a denial of service, as described by the CVEs in the "Vulnerability Details" section. These vulnerabilities have been...

WordPress Create by Mediavine plugin <= 1.9.7 - Contributor+ Stored Cross-Site Scripting via Schema Meta Shortcode vulnerability

Contributor+ Stored Cross-Site Scripting via Schema Meta Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Create by Mediavine versions = 1.9.7...

WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 5.6.0 is vulnerable to Cross Site Scripting (XSS)

Software The Plus Addons for Elementor Page Builder Lite Type Plugin Vulnerable versions = 5.6.0 Fixed in 5.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4983 Patch priority Low CVSS severity Low 6.5 Developer POSIMYTH Innovations PSID...

WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability

Contributor+ Broken Access Control vulnerability discovered by Security audit in WordPress Plugin Advanced Custom Fields PRO versions 6.3.2...

UBUNTU-CVE-2024-34580

Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing XMLDsig specification without protection against an SSRF payload in a KeyInfo element. NOTE: the project disputes this CVE Record on the grounds that any vulnerabilities are the result of a failure to...

PT-2024-25994 · Apache · Apache Xml Security For C++

Name of the Vulnerable Software and Affected Versions: Apache XML Security for C++ versions 2.0.4 and earlier Description: The issue is related to the implementation of the XML Signature Syntax and Processing XMLDsig specification, which lacks protection against an SSRF payload in a KeyInfo...

Malicious code in lita_telegram-plus (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6973 Malicious code in lita_telegram-plus (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5885 Malicious code in request-plus (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in request-plus (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in launchdarkly-cpp-server (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress core < 6.5.5 - Contributor+ Path Traversal (Windows Only) vulnerability

Contributor+ Path Traversal Windows Only vulnerability discovered by Rafie M & Edouard L Patchstack in WordPress core versions 6.5.5...

CVE-2024-38373

FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the...

CVE-2024-38373 FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser

FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the...

CVE-2024-38373 FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser

FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the...

CVE-2024-38373 FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser

FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the...

CVE-2024-38373

CVE-2024-38373 affects FreeRTOS-Plus-TCP, specifically versions 4.0.0 through 4.1.0. The issue is a buffer over-read in the DNS Response Parser when processing domain names in a DNS response, which can allow reading beyond the DNS response buffer if a crafted response uses a domain name length va...

WordPress Bible Text plugin <= 0.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Bible Text versions = 0.2...

FreeRTOS-Plus-TCP Security Vulnerability

FreeRTOS-Plus-TCP is an extensible open source and thread-safe TCP/IP stack for FreeRTOS. A security vulnerability exists in FreeRTOS-Plus-TCP versions prior to 4.1.1 that stems from a buffer over-read in the DNS response parser...

CVE-2024-5455

The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazinestyle' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level...